cloudutils: Do not configure selinux/apparmor when setup cloudstack agent - #13281
cloudutils: Do not configure selinux/apparmor when setup cloudstack agent#13281weizhouapache wants to merge 6 commits into
Conversation
|
@blueorangutan package |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #13281 +/- ##
============================================
+ Coverage 18.75% 18.89% +0.13%
- Complexity 17966 18224 +258
============================================
Files 6160 6174 +14
Lines 552578 555226 +2648
Branches 67348 67774 +426
============================================
+ Hits 103660 104885 +1225
- Misses 437512 438820 +1308
- Partials 11406 11521 +115
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
@blueorangutan package |
There was a problem hiding this comment.
Pull request overview
This PR stops CloudStack KVM agent setup from actively disabling host security policy mechanisms during setup, leaving SELinux/AppArmor posture to operators.
Changes:
- Makes AppArmor and SELinux setup configuration methods return without modifying host policy.
- Removes the legacy
setup_agent.shscript that also forced SELinux permissive mode. - Removes stale Java comments referencing the deleted setup script.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
python/lib/cloudutils/serviceConfig.py |
No-ops AppArmor/SELinux configuration during agent setup. |
scripts/vm/hypervisor/kvm/setup_agent.sh |
Deletes obsolete KVM agent setup helper script. |
server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java |
Removes stale commented reference to setup_agent.sh. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@blueorangutan package |
|
@DaanHoogland |
|
with the changes ubuntu 24 debian12 oraclelinux 8 suse15 oraclelinux 9 |
|
@blueorangutan package |
1 similar comment
|
@blueorangutan package |
|
@blueorangutan help |
9458007 to
1325b34
Compare
|
@blueorangutan package |
weizhouapache
changed the title
|
@blueorangutan package |
0c323ce to
1325b34
Compare
|
@blueorangutan package |
|
moving to 4.24.0 milestone |
|
It really did shut up, hahahahahhahaa..... 😁 |
andrijapanicsb
left a comment
andrijapanicsb
left a comment
There was a problem hiding this comment.
I agree with the main idea of this PR. CloudStack Agent setup should not
automatically change the AppArmor or SELinux configuration of the host.
I think we should clarify one important point in the documentation. This PR
only prevents CloudStack from making these changes in the future. It does not
revert changes already made on existing hosts. For example, existing hosts may
still have SELinux in permissive mode, disabled AppArmor profiles, or
security_driver="none". The administrator must change these settings manually
if needed.
The test results shared in this PR show security_driver="none" on all tested
hosts. This confirms the manually preconfigured scenario, but it does not test
a new host where security_driver is not configured. In that case, libvirt may
automatically use AppArmor or SELinux for QEMU processes. I think this
difference should be clearly explained in the documentation.
The related documentation PR apache/cloudstack-documentation#662 should be
updated and merged together with this change.
The AppArmor section title should also include Debian, because Debian uses the
same AppArmor configuration approach in this case. I suggest changing:
Configure AppArmor (Ubuntu, SUSE)
to:
Configure AppArmor (Ubuntu, Debian, SUSE)
The package installation commands may still need separate examples for
Ubuntu/Debian and SUSE.
I do not think the following command should be recommended:
aa-enforce /etc/apparmor.d/*
It may affect unrelated AppArmor profiles and directories. If it is necessary
to re-enable the libvirt profiles, the commands should target only these
profiles:
aa-enforce /usr/sbin/libvirtd
aa-enforce /usr/lib/libvirt/virt-aa-helper
The current documentation also says that AppArmor and SELinux must be
disabled. This text should be updated because it conflicts with the purpose
of this PR.
The unrelated log message change in test_vpc_redundant.py could also be
removed from this PR, but this is not a blocker.
Description
This PR disables security configurations during CloudStack agent setup:
However, users have different security and hardening requirements, and these decisions should not be enforced by the agent setup. For example:
Some environments may require SELinux/AppArmor to remain in enforcing mode for stronger security hardening, and the system should still support such configurations.
Some users may prefer to explicitly configure the libvirt security driver in
/etc/libvirt/qemu.conf, replacingsecurity_driver="none"with:Note that this configuration may not be compatible with certain VM or volume features and could require additional changes. If so, those cases are outside the scope of this PR and can be addressed in future improvements.
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?